The cloud that enterprises and governments run on.

The cloud is renting computing — servers, storage, software — over the internet instead of owning it. Microsoft runs data centres worldwide; you use what you need and pay for that.

Three models describe how much Microsoft manages versus you:

• IaaS (Infrastructure) — you rent raw virtual machines and manage the rest. Most control.
• PaaS (Platform) — you give Microsoft your app; it runs the servers for you.
• SaaS (Software) — you just use finished software, like Microsoft 365. Least worry.

Buying your own servers is capital expenditure (CapEx) — a big payment upfront for hardware you then own and maintain. The cloud turns this into operational expenditure (OpEx) — a running cost you pay as you go, like electricity.

This is the business heart of the AZ-900 exam, and it is not just accounting. OpEx means you can start tiny, with no capital, and only pay more as you grow and earn.

Azure is organised into regions (geographic areas of data centres). Within many regions there are Availability Zones — physically separate data centres — so you can run across zones and survive one failing.

The shared responsibility model is the rule you must never forget: Microsoft secures the cloud itself (buildings, hardware, network); you are responsible for your data, your accounts, and your access settings. The split shifts with the service model — more is yours with IaaS, less with SaaS — but your data and identities are always yours to protect.

Azure gives you several ways to run code, from most control to least management:

• Virtual Machines — full computers you control (IaaS).
• App Service — host a website or API; Azure manages the servers (PaaS).
• Azure Functions — run a small piece of code on an event, no server at all (serverless).
• Azure Kubernetes Service (AKS) — managed Kubernetes for containers.

The skill is choosing the simplest option that fits. A standard website belongs on App Service, not on a VM you have to patch yourself.

Azure Storage holds your data. The workhorse is Blob Storage for files — images, videos, backups — with hot, cool and archive tiers that trade cost against access frequency, just like other clouds.

Networking starts with the Virtual Network (VNet) — your private network in Azure. Resources inside it talk to each other privately, and you open access to the outside world deliberately with Network Security Groups (NSGs), which act as firewalls.

Microsoft Entra ID (formerly Azure Active Directory) is Azure’s identity service — it manages who your users are and what they can sign in to. It is the front door to everything.

Two ideas carry it: authentication (proving who you are) and authorisation (what you are allowed to do). The single most important security feature it offers is Multi-Factor Authentication (MFA) — requiring a second proof, like a code on your phone, beyond the password.

Good security is not one wall but many layers — defence in depth — so that if one fails, others still protect you. Azure provides tools at each layer: NSGs and Firewall at the network, Entra ID at identity, encryption for data, and Microsoft Defender for Cloud watching the whole thing and scoring your security posture.

For the exam and for real life, know that data is encrypted at rest (while stored) and in transit (while moving) by default on Azure — a strong baseline you get for free.

RBAC is how you control who can do what in Azure, built on least privilege: grant each person only the access their job needs. You assign a role (a set of permissions) to a user or group, scoped to a specific resource, resource group or subscription.

Azure’s structure keeps large estates tidy: a subscription is a billing and management boundary; resource groups bundle related resources so you can manage and delete them together; tags are labels (like env=prod or project=academy) that help you track cost and ownership.

Azure Policy lets you enforce rules automatically — for example "no one may create resources outside Europe" — so mistakes are prevented, not just caught later.

Most Azure services are pay-as-you-go: you pay for what you consume — compute per second, storage per gigabyte, data transfer per gigabyte. Prices vary by region and by service tier.

Two tools help you plan: the Pricing Calculator (estimate a design’s cost before you build) and the Total Cost of Ownership (TCO) Calculator (compare cloud against running your own servers). Use the Pricing Calculator before every real project — guessing at cloud cost is how bills surprise people.

Pay-as-you-go is flexible but not always cheapest. If you know you will run a server for a year or more, a Reserved Instance commits you to it in exchange for a large discount. Right-sizing means picking a VM that matches real need, not the biggest one "to be safe".

Microsoft Cost Management shows where your money actually goes — by service, by resource group, by tag — and lets you set budgets with alerts. Set a budget on day one and let Azure email you well before you reach your limit.

An administrator lives in identity. In Entra ID you create users, bundle them into groups, and assign access to the group — so a new hire gets the right access just by joining the group, and loses it by leaving. This scales far better than per-person grants.

You will do much of this with the Azure CLI (az) — scriptable and repeatable — and Cloud Shell, a browser terminal with az ready to go.

Beyond understanding RBAC, the administrator assigns it correctly. The practical rules: assign roles to groups, not individuals; scope to the narrowest level that works (resource group over subscription); and audit assignments regularly to remove access people no longer need.

Conditional Access (an Entra ID feature) lets you set smart sign-in rules: "require MFA when signing in from outside the office", or "block sign-ins from countries we never operate in". It applies security based on context, not a blanket rule that frustrates everyone.

The administrator creates VMs with the right size, image and disk, in the right region, and knows how to resize them as needs change. You choose a VM series for the workload (general-purpose, compute-optimised, memory-optimised) and attach managed disks for storage.

One VM is a single point of failure. For reliability you spread across an Availability Set or Availability Zones so one hardware fault does not take you down. For handling variable load you use a Virtual Machine Scale Set — a group of identical VMs that grows and shrinks automatically with demand.

Pair a scale set with a load balancer and you have a system that absorbs a traffic spike and then shrinks back down to save money when it is quiet.

Not everything should be a VM. App Service hosts web apps and APIs as a managed platform — you deploy code or a container and Azure handles the servers, patching, scaling and HTTPS certificate. For container-heavy systems, Azure Container Apps or AKS run your containers managed.

Data lives in a storage account, which holds blobs (files), file shares, queues and tables. The administrator sets the access tier (hot/cool/archive), configures redundancy (how many copies, and whether across regions), and controls access with SAS tokens — time-limited keys that grant exactly the access needed and then expire.

Two managed databases cover most needs. Azure SQL Database is managed SQL Server — relational, familiar, with backups and high availability handled for you. Azure Cosmos DB is a globally-distributed NoSQL database for apps that need low latency for users anywhere and flexible data.

Choose relational (Azure SQL) for structured, related data (finance, inventory); choose Cosmos DB when you need global reach and flexible documents (a product catalogue serving several countries). Either way, "managed" means you run a serious database without being a full-time DBA.

An administrator who cannot restore data is not doing the job. Azure Backup protects VMs, databases and files on a schedule, and Azure Site Recovery can fail an entire system over to another region in a disaster.

The administrator designs the network: VNets divided into subnets, connected to each other with peering, protected by NSGs, and named with Azure DNS. A clean network design — separate subnets for web, app and database tiers — is both more secure and easier to reason about.

For connecting Azure to an office or another cloud, a VPN Gateway creates a secure tunnel over the internet.

Azure Monitor gathers metrics and logs from everything you run; Log Analytics lets you query them; alerts notify you when something crosses a threshold. The administrator builds dashboards for the signals that matter and wires alerts to email or SMS — the same golden-signals discipline, native to Azure.

Clicking in the portal is fine to learn; real administration is Infrastructure as Code. Azure’s native IaC language is Bicep (a clean, readable layer over ARM templates) — you describe your resources in a file, version it in Git, and deploy it repeatably. Terraform works on Azure too, if you prefer one tool across clouds.